AgenticData: Autonomous Data Systems

• AgenticData is a paradigm where autonomous agents orchestrate data discovery, governance, and execution across heterogeneous resources.
• It employs layered architectures that separate deterministic data execution, adaptive control, and explicit policy governance to enhance transparency and efficiency.
• The systems convert natural-language queries into structured intermediate programs, ensuring both safe execution and traceable decision-making.

AgenticData denotes a class of data systems in which autonomous or semi-autonomous agents participate directly in data discovery, preparation, governance, optimization, analysis, and execution over heterogeneous resources, rather than merely answering questions about static datasets. In recent arXiv work, the term appears both as the name of a specific heterogeneous analytics system and as a broader paradigm in which data infrastructures become behaviorally responsive, policy-aware, artifact-centric, and execution-grounded substrates for agent reasoning and action (Sun et al., 7 Aug 2025, Zhu et al., 27 Oct 2025, Ang et al., 8 Jul 2026).

1. Concept and autonomy spectrum

A concise formalization in the survey literature models a data agent as a mapping

$$\mathcal{A}: (\mathcal{T}, \mathcal{D}, \mathcal{E}, \mathcal{M}) \rightarrow \mathcal{O},$$

where $\mathcal{T}$ is the task, $\mathcal{D}$ raw data, $\mathcal{E}$ the environment, $\mathcal{M}$ the LLMs, and $\mathcal{O}$ the output. The same survey argues that the phrase “data agent” is often applied too broadly, conflating simple assistants with systems that actually orchestrate the Data + AI ecosystem. It therefore proposes a six-level hierarchy from L0: No Autonomy through L5: Full Autonomy, with L2: Partial Autonomy denoting procedural execution inside human-defined pipelines and L3: Conditional Autonomy denoting autonomous orchestration under supervision. The paper explicitly identifies the current frontier as the L2-to-L3 transition, and places present-day systems such as AgenticData in a Proto-L3 position rather than treating them as completed autonomous data agents (Zhu et al., 27 Oct 2025).

This autonomy-centered framing distinguishes AgenticData from adjacent categories. The enterprise-oriented RUBICON paper argues that contemporary LLM-centric tool-use architectures are a poor fit for governed enterprise data because they hide orchestration inside opaque conversational loops and discard schema-rich structure when enterprise systems are treated as text or generic tools. Its alternative is an explicit, inspectable query-planning system over heterogeneous sources, with visible intermediate relations and wrapper-mediated access control, rather than a black-box chatbot deciding all actions at runtime (Wenz et al., 23 Apr 2026). A complementary systems perspective comes from “Agentic Data Environments,” which argues that the core shift is from reading data to acting on it, and that the proper object of design is not merely a database or an agent framework but a broader execution substrate spanning files, APIs, processes, derived artifacts, and system metadata (Ang et al., 8 Jul 2026).

A recurring implication is that AgenticData is best understood not as a single model capability but as a systems property. The common threshold is not whether an LLM can generate SQL or code, but whether the surrounding system can safely interpret high-level intent, discover and prepare the right data, choose and execute multi-step workflows, expose intermediate state, and bound failure consequences.

2. Architectural patterns

Recent work converges on a layered architectural style that separates data execution, adaptive reasoning, and normative control. In “Governing Cloud Data Pipelines with Agentic AI,” the central decomposition is a Data Plane, an Agentic Control Plane, and a Policy and Governance Plane. The Data Plane remains conventional and deterministic, using engines such as Spark, Flink, or managed ETL systems; the Agentic Control Plane hosts specialized agents for monitoring, optimization, schema handling, and recovery; and the Policy and Governance Plane holds declarative, versioned, auditable rules governing cost budgets, access control, compliance constraints, and recovery objectives. The architectural claim is that agents may propose actions, but policy validation mediates all execution (Kirubakaran et al., 24 Dec 2025).

A second pattern appears in the “Agent-Centric Data Fabric,” which is organized into an Agent layer, an Orchestration layer, and an Execution layer. Here the fabric is explicitly described as an “adaptive collaborator” rather than a passive executor. The Agent layer forms context federations and local micro-caches; the Orchestration layer provides an attention-guided router, predictive prefetcher, cross-agent cache manager, and cross-engine optimizer; and the Execution layer spans relational databases, vector stores, stream processors, and inference servers. The focus is not on a single central planner but on continuous adaptation to “dynamic agentic workloads” whose structure and semantics emerge during reasoning (Giurgiu et al., 10 Dec 2025).

Enterprise analytics work introduces a related but more asset-oriented decomposition. QwenPaw-Data separates DataBridge, Skill-Hub, and Host. DataBridge maintains a semantic evidence substrate built from a Metadata Graph, Knowledge Graph, and Trace Graph; Skill-Hub codifies expert analytical methodology as reusable skills; and Host materializes evidence and methods into controllable, artifact-centric execution. The system’s explicit goal is to make semantics, methodology, execution, and evolution first-class system concerns in enterprise analysis (Zeng et al., 13 Jul 2026).

Scientific and scholarly systems instantiate the same principle in domain-specific form. SciDataCopilot builds a structured knowledge base $\{D, T, C\}$, where $D$ is a scientific data repository, $T$ a tool repository, and $C$ a case repository, then routes execution through four agents: Data Access Agent, Intent Parsing Agent, Data Processing Agent, and Data Integration Agent (Rao et al., 9 Feb 2026). AgenticScholar similarly couples a structure-aware scholarly knowledge representation layer to an LLM-centric hybrid query planning layer and a unified execution layer with composable operators, so that natural-language research questions become executable DAGs over multimodal scholarly corpora (Lan et al., 14 Mar 2026).

Across these systems, a stable architectural thesis emerges: deterministic execution is preserved; adaptive reasoning is isolated into a control layer; and governance, provenance, or evidence management is lifted into explicit data structures rather than being left implicit in prompts.

3. Planning, operators, and execution models

A defining feature of AgenticData systems is that they convert open-ended requests into explicit intermediate programs. In AgenticData itself, a natural-language analytics query is translated into a tree-structured semantic plan composed of relational and semantic operators such as DBScan, FileScan, WebScan, Filter, Project, Aggregate, Extract, Union, and multiple merge variants. Planning is multi-stage: a data profiling agent discovers and profiles relevant sources, a data planning agent produces a high-level semantic logical plan, and a data manipulation agent fills in executable details such as SQL for database scans and tool parameters for file scans. Validation then checks grammatical executability and semantic completeness using parallel cross-validation with majority approval, and optimization applies rewrite rules, join-order optimization, and quality-aware LLM selection before bottom-up execution (Sun et al., 7 Aug 2025).

Other systems formalize this transition from prompt to program more explicitly. Agentics 2.0 defines a typed semantic transformation as a transducible function

$\mathcal{T}$0

subject to typed output, explainability, local evidence, and provenance constraints. These functions compose sequentially, support identity and monoid structure, and lift naturally into asynchronous map-reduce pipelines. In this view, agentic data workflows are not prompt chains but typed programs over Pydantic-defined semantic records, with slot-level evidence tracing between inputs and outputs (Gliozzo et al., 4 Mar 2026).

The “Agent-Centric Data Fabric” introduces a different formalism centered on retrieval and serving. Attention-guided data retrieval assigns soft routing weights to candidate sources or partitions: $\mathcal{T}$1 where $\mathcal{T}$2 is the query embedding, $\mathcal{T}$3 the source or partition embedding, and $\mathcal{T}$4 a selectivity parameter. Quorum-based data serving then permits early return once a confidence function over coverage, diversity, and agreement exceeds a threshold. These mechanisms are offered as architectural primitives for workloads whose query graph and access paths emerge during reasoning rather than being fixed at submission time (Giurgiu et al., 10 Dec 2025).

Interactive analysis systems adapt the same idea into inspectable execution traces. DA-Studio uses an action-structured backend with explicit tags such as <Analyze>, <Understand>, <Code>, <Execute>, and <Answer>, and runs generated code in a session-scoped Docker sandbox while surfacing streamed action traces, intermediate artifacts, and editable code. CEDAR uses a related notebook-like representation in which a solution is materialized as an enumerated sequence of interleaved plan and code blocks generated by separate LLM agents, with local execution and smart history rendering to keep context manageable (Liu et al., 30 Jun 2026, Roy et al., 10 Jan 2026).

A common systems insight is that explicit intermediate programs—semantic plans, DAGs, typed transductions, or action traces—serve simultaneously as execution objects, optimization targets, and observability surfaces.

4. Functional scope across the data lifecycle

AgenticData research now spans most stages of the data lifecycle, but in different application regimes. In heterogeneous analytics, AgenticData addresses the case where users ask natural-language questions over mixed structured and unstructured sources. The system reports superior accuracy on DABStep, Spider-2.0-Lite, and a Wikipedia benchmark, and attributes this to feedback-driven planning, semantic cross-validation, and cost-aware execution over relational and semantic operators (Sun et al., 7 Aug 2025).

In cloud operations, Agentic Cloud Data Engineering treats pipeline management itself as an agentic problem. Its Monitoring Agent detects anomalies in latency, data freshness, and failure rates; its Optimization Agent proposes resource and scheduling adjustments; its Schema Agent identifies schema drift and recommends reconciliation strategies; and its Recovery Agent selects remediation actions such as replay, rollback, or partial recomputation. The system is motivated by workload volatility, schema evolution, infrastructure contention, cost ceilings, and enterprise governance constraints, and is evaluated on representative batch and streaming workloads over TPC-DS, open government datasets, NYC Taxi Trip Records, and synthetic event streams (Kirubakaran et al., 24 Dec 2025).

Scientific data preparation is a second major domain. SciDataCopilot targets raw experimental data that are highly heterogeneous, domain-specific, and not naturally aligned with text-centric AI systems. It formalizes a “Scientific AI-Ready” paradigm around typed data units, tool contracts, reusable cases, and constraint-driven integration. Its life-science evaluation produces 214,104 structured reaction records, including 168,576 unique enzymes, 4,483 substrates, and 5,752 products; its neuroscience evaluation reports expert-comparable outcomes on alpha extraction, EOG regression, ICA decomposition, and EEG preprocessing with 3–5× faster execution; and its earth-science case completes a temporal restructuring workflow in 3.5 min versus 75 min for a human baseline (Rao et al., 9 Feb 2026).

A third branch of the field treats data creation itself as agentic. Autodata introduces an “agentic data scientist” that generates candidate examples, evaluates them with weak and strong solvers, diagnoses failure modes, and revises its own generation strategy. Its practical implementation, Agentic Self-Instruct, uses an orchestrator plus challenger, weak solver, strong solver, and verifier/judge. Across computer-science research reasoning, legal reasoning, and mathematical scientific reasoning, the paper reports improved downstream RL outcomes relative to classical synthetic dataset creation methods, and shows that meta-optimizing the data scientist agent itself yields additional gains (Kulikov et al., 24 Jun 2026).

Enterprise data products and data quality are also within scope. The Agentic Control Center for Data Product Optimization treats a data product as a versioned state containing table metadata, question mappings, query versions, answer versions with confidence scores, and view definitions, then optimizes it continuously using Planner, Input Planner, and specialized agents for question generation, text-to-SQL, follow-up question generation, clustering, and view creation (Tamilselvan et al., 10 Mar 2026). For data quality, the unified agentic-retrieval framework for context-aware DQA interprets natural-language intended use, derives context-aware assessment strategies, generates executable validation logic, and then passes all generated rules through a feasibility validation stage before deterministic execution in pandas and DuckDB (Fadlallah et al., 15 May 2026).

The breadth of these use cases suggests that AgenticData is no longer restricted to analysis-time query answering. It now includes governance, quality assessment, data product maintenance, scientific preparation, synthetic data generation, and runtime optimization over dynamic infrastructures.

5. Governance, safety, and bounded autonomy

A recurring principle across the literature is that autonomy must be bounded by architectural controls rather than delegated entirely to model behavior. In cloud data engineering, bounded autonomy is implemented by policy mediation: agents can suggest adaptive resource reconfiguration, schema reconciliation, replay, rollback, partial recomputation, postponement of execution, or selective reprocessing, but all actions are validated by a declarative Policy and Governance Plane before execution. Policies cover cost budgets, access control, compliance constraints, and recovery objectives, and are explicitly described as declarative, versioned, and auditable (Kirubakaran et al., 24 Dec 2025).

The same pattern appears in enterprise data governance under legal regulation. The DPDP framework organizes governance into a Perception Layer, Reasoning Layer, Orchestration Layer, and Action Layer, with a KYU Agent that models requester trustworthiness and a Compliance Agent that reasons about data sensitivity using a hybrid LLM + RAG pipeline over machine-readable tuples extracted from the DPDP Act. The final privacy-preserving output is evaluated with an Anonymisation Score

$\mathcal{T}$5

where $\mathcal{T}$6 and $\mathcal{T}$7 are original and anonymized attribute values and $\mathcal{T}$8 is a domain-appropriate distance metric. The reported domain means range from 0.63 in E-commerce, Social Media, and Telecom to 0.35 in Government (Kulkarni et al., 3 Jan 2026).

Safety research broadens these ideas from policy enforcement to execution substrates. “Agentic Data Environments” argues that state safety and data safety must be handled separately: branching isolates speculative state mutations, while Data Flow Control (DFC) constrains legal flows of information from sources such as relations or files to sinks such as prompts, tools, tables, memory, or external APIs. The paper’s motivating claim is that agentic automation is fundamentally a read-write problem, and that adoption depends on bounding abrupt, catastrophic, and difficult-to-reverse failure costs rather than merely improving average-case performance (Ang et al., 8 Jul 2026).

More restrictive enterprise architectures replace open-ended tool orchestration with inspectable plans. RUBICON does this through AQL (Agentic Query Language) and source-specific wrappers that enforce access control, schema alignment, and result normalization, so that complex enterprise questions are decomposed into visible, auditable query plans rather than hidden chains of LLM calls. The intended guarantees are stronger determinism, transparency, traceability, and performance predictability than standard ReAct-style tool loops (Wenz et al., 23 Apr 2026).

Taken together, these systems define a characteristic AgenticData safety model: policy-aware reasoning, deterministic execution surfaces, auditable intermediate artifacts, rollback or branching mechanisms, and explicit rejection of unconstrained agent write access.

6. Benchmarks, datasets, and empirical evidence

The empirical infrastructure for AgenticData has expanded substantially. AgenticDataBench provides a benchmark of 344 tasks built from 97 real datasets across 15 domains, with 433 representative skills extracted from 6,510 Stack Overflow task-solution pairs and expert annotation over both public and business data. The benchmark includes 102 business instances and 242 generated public-data instances, supports multiple output-evaluation modes, and reports that the best evaluated harness–LLM combination reaches 48.8 overall. It is explicitly designed to diagnose skill-level failures rather than only end-to-end scores (Sun et al., 2 Jul 2026).

Some resources focus on agentic ecosystems themselves as data. The ERC-8004 Ethereum dataset covers the first 10,000 blockchain-registered AI agents, with exact identity completeness over token IDs 0–9999, a lifecycle split of 7,856 minted_only and 2,144 metadata_linked, 72 agents with valid structured metadata, 112 extracted service records, and 980 feedback records from 197 unique client addresses. This dataset enables empirical work on persistent agent identity, ownership, service exposure, and on-chain reputation in decentralized agentic economies (Liu, 24 Apr 2026).

System papers increasingly report quantitative gains on realistic workloads. Agentic Cloud Data Engineering reports reductions in mean pipeline recovery time by approximately 45%, operational cost by approximately 25%, and manual intervention events by over 70% relative to static orchestration, while maintaining data freshness and policy compliance (Kirubakaran et al., 24 Dec 2025). QwenPaw-Data reports about 96.5% correctness on 29 objective queries, average user satisfaction of 71.6 versus 34.1 for a leading general-purpose agent on 37 open-ended enterprise analysis tasks, and roughly 42% lower average context token consumption (Zeng et al., 13 Jul 2026). AgenticData itself reports 94.44 on easy and 50.79 on hard DABStep tasks, 44.5 on Spider-2.0-Lite versus 35.6 for ReFoRCE, and 95 on Wikipedia versus 94 for Palimpzest, with much lower cost on the Wikipedia cost-quality frontier (Sun et al., 7 Aug 2025).

Training-data research is also becoming part of the evaluation ecosystem. OpenThoughts-Agent contributes a fully open curation pipeline for agentic model training, more than 100 controlled ablation experiments, and a 100K-trajectory SFT dataset. Fine-tuning Qwen3-32B on this data yields 44.8% average accuracy across seven agentic benchmarks, a 3.9 percentage point gain over Nemotron-Terminal-32B (40.9%), and stronger compute-controlled scaling than alternative open datasets at every training set size tested (Raoof et al., 23 Jun 2026).

These benchmark and dataset efforts mark a shift from anecdotal demos toward measurable, comparative AgenticData research, although evaluation remains uneven across domains.

7. Limits and open directions

Despite rapid architectural diversification, many papers explicitly acknowledge that current AgenticData systems are not yet fully autonomous. The data-agent survey argues that most present systems remain at L2 or Proto-L3, and that the unresolved transition is from procedural execution inside human-defined pipelines to autonomous orchestration over diverse, comprehensive data tasks. The specific bottlenecks it identifies are limited autonomy in pipeline orchestration, incomplete lifecycle coverage, insufficient strategic reasoning, and weak adaptation to dynamic environments (Zhu et al., 27 Oct 2025).

Formalism is also uneven. Several influential papers are intentionally architectural and empirical rather than mathematically optimized. Agentic Cloud Data Engineering does not define a mathematical optimization problem, reward function, cost function, or safety proof, and lacks ablations over specialized agents or policy strictness (Kirubakaran et al., 24 Dec 2025). The Agent-Centric Data Fabric is likewise a position paper: it proposes attention-guided retrieval, semantic micro-caching, predictive prefetching, and quorum-based serving, but leaves unified cost modeling, context-aware attention mapping, probing under uncertainty, consistent semantic caching, and uncertainty fusion as open problems (Giurgiu et al., 10 Dec 2025).

Operational limitations are equally prominent. Scientific and enterprise systems remain dependent on metadata quality, historical cases, curated skills, or governance review. SciDataCopilot notes continuing need for curated tools and domain oversight, especially for final validation in high-stakes scientific settings (Rao et al., 9 Feb 2026). QwenPaw-Data identifies stronger confidence estimation, tenant isolation, fine-grained permission control, secure execution environments, and improved skill transfer as future work (Zeng et al., 13 Jul 2026). Agentic Data Environments highlights unresolved issues in cross-component branching semantics, consistent snapshots without a shared transaction boundary, environment-level provenance, external-service branching, and scalable policy management (Ang et al., 8 Jul 2026).

This suggests that the field’s main trajectory is not toward unconstrained autonomy, but toward richer execution substrates, more explicit methodological assets, stronger provenance and policy machinery, and broader yet more tightly governed evaluation. In that sense, AgenticData is evolving less as a single application category than as a systems discipline for making data-intensive autonomy reliable, inspectable, and operationally bounded.